Make AC::Params.permit_all_parameters thread safe

[sikachu]

As discussed in #16299(1), this attribute is not thread safe and could potentially create a security issue.

[sikachu]

This may also needed to be backported to 4-2-stable.

[chancancode]

Reverted in 5923ee6 and added a note about thread safety. If we really want to support mutating this at runtime, we can do something along the lines of...

def self.permit_all_parameters
  if Thread.current.key?(:action_controller_permit_all_parameters)
    Thread.current[:action_controller_permit_all_parameters]
  else
    # Inherit from config.action_controller.always_permitted_parameters or elsewhere
  end
end

def self.permit_all_parameters=(value)
  Thread.current[:action_controller_permit_all_parameters] = value
end

Not sure if we need to though.